Link to the article

Link to the tutorial

Link to the article

This article was reposted from the “NetworkWorld” website.

VMware’s VMworld has quickly become one of the most important business technology conferences of the year. Held at San Francisco’s Moscone Center Monday through Thursday of this week, the conference had its share of highlights and interesting facts. Here are 10 things seen and heard at VMworld:

The hottest virtualization products at VMworld

1. VMworld drew 17,021 registered attendees, a huge jump over last year’s 12,488. This year’s list of registered attendees includes 4,000 who had never been to VMworld before and 55 who have been to every single VMworld going back to 2004. These 55 dedicated VMworld attendees sat in a special area close to the keynote stage.

2. The show also attracted more than 200 sponsors and exhibitors, including top-tier sponsors Cisco, Dell, EMC and NetApp. There were 170 breakout sessions for attendees looking to learn about virtualization technology (mostly VMware’s).

3. One such session titled “Head-to-Head Comparison: The VMware Advantage Over Microsoft for Building a Private Cloud,” was designed to help customers “make fact-based decisions on where to invest.” The session, led by VMware executives, provided a completely unbiased (wink, wink) comparison of VMware and Microsoft technologies.

4. Microsoft, meanwhile, took out a full-page ad in USA Today pleading with customers not to sign three-year contracts with VMware. VMware CEO Paul Maritz, a former Microsoft Windows executive, called the ad a “sincere form of flattery,” while noting that “For Microsoft to talk about lock-in is a severe case of the pot calling the kettle black.” Microsoft, by the way, has claimed that VMworld rules limit competition, but offered demos of Windows Azure to attendees. (Microsoft vs. VMware: Who’s better at disaster recovery?)

5. The large keynote stage featured some attempts at humor, with VMware CTO Stephen Herrod and other VMware executives using scooters to move from one side of the stage to the other. There was also a video spoofing the Matrix film, complete with the Oracle explaining that the cloud is everywhere and that our minds are simply “dumb terminals.” The video also compared cloud computing to the process of ordering pizza. The bits were well-received by the audience, which seemed to think them funnier than most attempts at vendor comedy.

6. EMC, the owner of VMware, was featured prominently as a sponsor but for the most part EMC’s majority ownership stake in VMware was not discussed. EMC positioned itself as just another VMware partner, albeit a large one, with a sign on the technology exhibition floor that said “EMC: #1 in storage for VMware.”

7. The show floor featured some wackiness, as always. The vendor Kingston Technology hosted Guitar Hero contests; CA’s booth featured women on stilts; and VMware’s giant booth took a page from Apple’s playbook with a “Genius Bar.”

8. The network powering VMworld lab sessions featured a 10 Gigabit core infrastructure; links to Terremark and Verizon facilities in Florida and Virginia; 244TB of useable storage; 352 servers; 736 CPU sockets; and 3,072 CPU cores. Overall, 125,000 virtual machines were expected to be deployed during the conference, to power 12,500 or so labs.

9. 3Par, a storage vendor that is the subject of a billion-dollar bidding war between HP and Dell, had plenty of money to splash around at VMworld. 3Par promoted storage virtualization at its large booth and gave away a 3D television.

10. VMware said it has 190,000 customers, “from AstraZeneca to Zappos,” and noted that 2009 was the first year in which the number of server applications deployed on virtualized infrastructure exceeded the number of applications deployed on physical servers. “There are now more copies of traditional operating systems that no longer see the hardware than those that do,” Maritz said.

August 30, 2010

This interview  was reposted from “The Metropolitan Corporate Counsel” website

Editor: Tell us about your practice and role at Proskauer, particularly as a founding member of the Litigation Department’s Electronic Discovery Task Force.

Goldberg: I am a patent attorney with an electrical engineering background. My practice is primarily patent and trade secret litigation, with lots of work in the telecommunications, barcode scanner and financial services fields.

Over the past couple of years, advising clients on electronic discovery-related issues, both in the absence of litigation and during litigation, has become a significant part of my practice. Before litigation, for example, I help clients develop information management systems to proactively reign in discovery costs and meet compliance obligations. During litigation, I help clients understand and manage the burden and costs of the process, with the goal being a rational e-discovery expenditure that, while meeting all obligations, minimizes the disruption to my client, and is proportionate to the amount at issue in the litigation. I also consult on the recovery of often-overlooked electronic evidence, such as computer forensics.

Recently I’ve focused on electronic discovery and alternate dispute resolution, and I am the primary author of the e-discovery section of the International Institute for Conflict Prevention and Resolution’s model economical litigation agreement, colloquially known as the “Litigation Prenup.”

Editor: “Cloud computing” is a buzzword that’s been popping up more frequently than ever. How would you define it?

Goldberg: Cloud computing is a marketing term that covers lots of different technologies and business applications. By way of example, the National Institute of Standards and Technology (“NIST”) is now on version 15 of their attempt to define the cloud, with the current definition two pages long, with lots of subparts.

I like the analogy in the book The Big Switch by Nicholas Carr for an initial introduction to the cloud concept, which compares the evolution of cloud computing to the transition from individual power generation to modern utilities.

Historically, factories needed to generate their own power. For example, a water wheel may have been built to power a factory’s machinery, with the construction of the wheel and its operation and maintenance falling entirely on that business. At some point, these local generators were replaced with centralized power generation, where power was generated remotely, distributed as a utility, and priced based upon consumption. There are many reasons why this development was a good thing. Utilities presumably know how to generate power better because that is their primary business, there are economies of scale, the consumer can ramp up or down its consumption quickly and easily, and the consumer doesn’t have to pay for the excess capacity that the consumer does not need.

Cloud computing is very much the same concept. Rather than building and maintaining its own IT infrastructure, an organization can instead purchase the use of a comparable infrastructure as a service, paying for what it consumes, and leaving it free to focus on its primary business. The cloud also supports business agility by allowing for the fast expansion or contraction of IT capabilities.

Editor: Why is it important for lawyers, particularly, in-house counsel, to take a closer look at how their companies are implementing this technology?

Goldberg: Cloud computing is an area of technology and a business model whose impact is going to reach across many legal areas, from electronic discovery to compliance to intellectual property. Accordingly, the stakes are very high as companies consider replacing internal systems with externally hosted ones.

Saving money is a common reason why organizations move to a cloud, and it’s important to understand whether the organization will actually realize those savings or just end up transferring costs from their IT budget to the legal budget. There are many legal costs that are often overlooked about which in-house counsel will need to be aware. First, there is the cost of a due diligence process, the investigation that takes place before entering into a contract for cloud-based services.

Second, there may be customization costs. If an organization needs to customize the cloud service to make it suitable for a specific need, that may be counter to the economies of scale and will likely involve additional cost.

Finally, I believe the potential change in risk exposure should be taken into account. This may be difficult to quantify as it is a discussion about possibilities and probabilities. For example, would an organization trade some amount in IT savings for an additional percentage chance of a patent litigation? It is going to fall on in-house counsel to help evaluate these risks and to generally make sure that the service will meet business objectives.

Editor: What is the most important legal question for organizations considering moving their data to the cloud?

Goldberg: Because of the many potential variations in the way cloud systems are implemented, technologically, structurally, and contractually, the legal risks are different with each system. The key legal question is whether a given cloud is suitable for a given application. Every cloud has to stand on its own merit and be evaluated separately with reference to the application for which it is intended. For example, you may not want to use the same cloud that you use for your personal emails to hold your corporation’s crown jewels.

Editor: What is the difference between public and private clouds, and why is that potentially important?

Goldberg: I mentioned NIST’s 15th attempt to define cloud computing earlier. Version 15 defines a private cloud as where the cloud infrastructure is operated solely for an organization and may be managed by the organization or a third party and may exist on premise or off premise. It defines a public cloud as a cloud where the infrastructure is made available to the general public or a large industry group and is owned by an organization selling cloud services.

A key distinction between public and private clouds, and one that is important from a legal standpoint, is that public clouds likely have multi-tenancy, or multiple unrelated consumers of the service. With private clouds, analysis of risk may be very different if data isn’t being placed into the hands of third parties.

Editor: How may standardization activities impact the adoption of cloud computing?

Goldberg: There are two aspects of standardization that are interesting. The first is contractual and the second is technological.

With regard to contractual standardization, it is well known that there is a lack of standardized terms in cloud computing contracts. Therefore, it is very difficult for in-house counsel to compare a cloud contract from one provider with a cloud contract from a second provider.

The Cloud Computing Project at Queen Mary University of London is an interesting attempt to address this issue. Funded by Microsoft, it is reviewing many common cloud contracts. If it is successful, some best practices may emerge. This should make the due diligence process a lot easier on in-house counsel.

The second aspect of standardization is the need for apples-to-apples comparisons of the technological features of clouds. For example, such issues as security and interoperability may be addressed. Standardization in this sense is needed to facilitate third-party technical audits which will, again, take some of the burden off of the customer during the due diligence process and potentially help speed up cloud adoption.

The potential downside to these standardization activities is that they may ultimately define standards of conduct creating risk for those using cloud systems that fall below those standards.

Editor: As an IP litigator, how do you think the use of cloud services will change the risk of patent litigation?

Goldberg: You are going to have a different risk of patent exposure when your service is hosted in the cloud as opposed to an internally hosted solution. The technologies used by a cloud provider to provide the cloud service won’t necessarily be the same as those used in an internally hosted version of the product.

For example, you may need different technologies to support multi-tenancy in the cloud. You will likely have different security concerns and need to deploy different solutions. In an internal system your security typically includes a firewall designed to keep outsiders off of your network and a permission structure designed to limit the access of employees only to information within the network that they need to know. In a public cloud, you are going to have all of that plus technology protecting your information from other customers of the cloud provider and from the cloud provider itself. The ways data moves and is stored in the cloud may also be different. This all contributes to different risks.

The structure of the cloud service will also impact risk. One cloud service could have a single provider that provides all of the necessary hardware and software. Another cloud may have multiple providers, where one provides the cloud hardware and the other provides the software. In the first example, the consumer is likely in a direct contractual relationship with the single provider. In the second example, the consumer may only be in a direct contractual relationship with one of the two providers, with the other provider having its own contract with the remaining provider.

For a more extreme example, the hardware provider may itself have contracted with other hardware providers, for example, for surge capacity. The consumer may not know at a given time the identity of all the participants in a cloud system or the location of its data. That is going to change the risk profile.

I would conclude by noting that there are a lot of cloud startup companies right now, and in fact the cloud makes it very easy for startups, because they don’t have to build their own hardware infrastructure.

The problem is that over time many or most startups will fail, and this can result in lots of orphaned patents which may ultimately become a burden on the cloud industry. For example, during the dot-com era, when the bubble burst, many startups that failed had patents, which survived and fell into the hands of non-practicing entities, whose business was bringing lawsuits. Likewise, orphaned patents held by failed startup cloud providers can create similar problems.

Editor: How can an organization manage the risk of patent infringement in the cloud?

Goldberg: Organizations could undertake patent clearance projects to try to identify what relevant patents are in the space, who is filing litigations in the space, and which providers already have licenses to patents that are of concern. However, in the cloud, such efforts could be complicated by a lack of transparency in cloud systems. The consumer may not actually even know or be able to learn how the cloud system is actually implemented at any given time.

Further, certain cloud contracts allow for the provider to change the system, sometimes without notice. Accordingly, you could have done a very thorough patent clearance project, but tomorrow the system, and its risk, may be different.

Another way to manage patent risks is through contractual indemnification. One potential problem is that the customer may not be in a direct contractual relationship with all of the providers of the cloud system. Thus, in a system with many providers, it may be difficult to get complete indemnification.

Editor: What other IP issues are concerns?

Goldberg: Protecting trade secrets in the cloud is another concern. Obviously, you have to take reasonable steps to maintain the secrecy of a trade secret in order for it to maintain its value. It is an open question of what is reasonable in the cloud context. Encryption is likely one answer to this problem.

Some cloud contracts may give the cloud provider certain rights in its customer’s data, and there is the potential that this could impact the value of that data. It is one thing when the provider gets rights that it needs to operate its systems, for example, the right to copy or move files in certain limited ways. But, there may be more serious ownership concerns that can impact the value of the data when the provider gets rights in its consumer’s data for revenue-related purposes, such as targeted advertisements.

Editor: Can you explain why the issue of “control” over the data in the cloud is important?

Goldberg: Electronic discovery obligations extend to documents in an organization’s custody or control. By moving documents to the cloud, the documents may no longer be in a litigant’s custody, but they may still be under its control. The starting point for analyzing this issue is the cloud contract. If ESI is under control of the litigant, it may fall within the litigant’s e-discovery obligations, meaning that it could be the litigant’s responsibility to preserve, retrieve and produce those documents in litigation despite the fact that they are not in its custody. Issues of control go beyond just the basic documents and also extend to things like metadata, log files and other associated ESI.

Before data is put on the cloud, it is important for the cloud customer to know how it is going to carry out these basic e-discovery functions, including making sure it has whatever rights and help it needs from the cloud provider. The cloud contract should also provide for how costs will be allocated.

The analysis of control in the cloud may be simple where a litigant has a direct contractual relationship with all the providers of the cloud service. It can be tricky with more complicated systems.

For example, let’s assume that the cloud contract provides a consumer with the right to access certain forensics. One of the things that the consumer will want to check during the due diligence process – if it is not in a direct relationship with the hardware provider – is whether the party with which it has contracted itself has the rights under its contract with the hardware provider to meet its obligations to the consumer.

Editor: Besides issues of control, how can cloud computing impact e-discovery?

Goldberg: Returning to the previous example, let’s assume that a log file is relevant to a case, but it is not under the control of the litigant. Does that mean it can’t be discovered? The answer to that is potentially “no,” as a discovery request could be sent directly to the cloud provider for such data. While these direct requests to the provider may be objectionable where the data is under the litigant’s control, here the log files may only be available from the cloud provider. How the provider responds in such cases depends in part on the cloud contract. Therefore, the contract should describe how the customer would like the provider to respond to those requests.

It is also important to note that the Stored Communications Act may also affect the cloud provider’s obligations to turn over data.

Editor: What is data persistence and why is it an important issue in the cloud?

Goldberg: Data persistence concerns how data survives in the cloud, in some cases after you expect or want it to be deleted. It is a good idea – and sometimes a necessity if compliance obligations are implicated – for an organization to make sure the cloud that they are contemplating using will comply with their information management system, and any applicable laws, before they move their data to the cloud.

It can be problematic if the cloud service cannot comply with the organization’s retention policies. For example, from an e-discovery point of view, it may mean that a litigant has to incur an expense that they could have avoided if the document had been properly deleted. The unexpected retention of the document could also lead to a direct request to the cloud provider for that document in litigation, particularly if it can be argued that the surviving copy is somehow outside of the litigant’s control.

From a compliance point of view, the improper retention of information on a cloud can lead to the violation of certain laws. For example the European Union Data Protection Directive specifies limits on how long data can be retained.

Editor: What steps can an organization take to minimize the impact of a cloud service on e-discovery?

Goldberg: Discovery on the cloud can be more complicated than normal discovery because your data is on a network controlled by someone else. Therefore, there may be restrictions on available tools that you can use, you may need to rely heavily on the provider in order to get things done, and you’ll have a lot less knowledge about the network than you do with your own network.

The heat of litigation may not be the ideal time to first address these limitations. It’s a good idea to identify how data will be collected and preserved before that data is put on the cloud. What the organization could then do is record the results of the due diligence in a data map or other litigation readiness tool and store that along with the contract. Should litigation later arise your organization will be prepared. This may also provide some defensibility should things go unintentionally wrong.

Editor: How important is the role of the lawyers?

Goldberg: The due diligence process, and ultimately the decision about whether to go to the cloud, should be an enterprise decision, bringing in the business stakeholders, IT and in-house legal. While the ease of purchasing certain cloud services may support ad hoc adoption, there may be many benefits to making such decisions in a uniform organization-wide manner.

This article was reposted from the “InformationWeek” website.

The Data Center Institute, a think tank for data center managers, says only 14.9% of the organization’s members have implemented some form of cloud computing. But, it predicts, “the next five years will see the adoption of cloud computing grow dramatically.”

The report was authored by leading members of AFCOM, the former Association for Computing Operations Managers, a name it has dropped in favor of use of just its acronym.

The organization completed a survey last September which came up with the 14.9% figure. If the remainder are not thinking of moving toward the cloud, either internal or external, then the institute’s position paper should act as a warning shot across the bows. The report issued Monday predicted: “Its impact on data center management will be felt throughout the industry.”

Cloud computing will grow because it can address several persistent issues that plague data center operations, the position paper said. They include:

Underutilization: “Many servers in data centers are underutilized; there are still some running 3-5% of total capacity, while others actually sit idle.”

Security: “Security continues to lag within most data centers… we need to focus on emerging approaches that center around the distributed model, including identity management and the new use of encryption, either within on-premise systems or within the cloud.”

Ability to scale: “Businesses that need to quickly scale will typically find latency between the identification of the need and the time additional capacity can actually be brought on-line.”

Cost per cycle: “Many IT budgets were slashed during the last economic downturn to force management to revisit the cost of computing, which is driving much of the data center consolidation as well as the movement toward cloud computing.”

In effect, AFCOM is telling its members to “take what you’ve got and develop a plan to use cloud computing to get some of those attributes,” said Leonard Eckhaus, founder of AFCOM, in an interview upon release of the position paper, Guiding Data Centers To Cloud Computing.

The paper adopts the same definition of cloud computing as the widely quoted National Institute of Standards and Technology, which describes a public cloud, such as Amazon’s EC2; a private cloud, such as an enterprise builds for internal operation; a hybrid combination of the two; and a community cloud, where a group of organizations share a data center infrastructure.

A key tenet of cloud computing for data center managers is that it allows them “to shift the risk of handling the processing load from your enterprise data center to the cloud computing provider… the cloud provider is better suited to accept that risk,” said the position paper.

Eckhaus said the paper was also intended to encourage thinking about private clouds or internal architectures that duplicate what’s being done in the external cloud, such as running highly virtualized environments and multi-tenant servers. Data center managers should also be thinking about implementing self-provisioning for end users, usage tracking, and chargeback, he said.

The paper lists core issues for data center managers to consider if moving to a private cloud. Cloud computing is denser than its predecessor forms, with heavily virtualized hosts.”You must carefully consider power management issues when moving to a cloud-based infrastructure,” the paper said.

Network management will also become more focused on “processes shared between physical servers within the data center versus… communications with entities outside the data center,” it said.

Virtualization under cloud computing allows flexible allocation of memory, CPU, and other resources; it’s focused on multi-tenancy and auto provisioning, said the paper.

To make the move toward the cloud, the institute urges:

– Get a realistic appraisal of where cloud computing will help with existing inadequacies. What are the business requirements that the cloud might solve?

– Understand the existing network assets.

–Catalog servers and storage, and know the existing function of each.

–Understand data assets, the type of databases, and data models employed.

– Catalog application assets and make explicit the databases that serve them.

– Form a logical view of the combined existing assets to get an “as is” view of the data center.

–Draft a logical “to be” view of a cloud-enabled data center, with its network, storage, and server assets working together in a more cloud-like fashion.

– Define the physical “to be” architecture that can support the logical view, “including selection of all the right enabling technology… This typically is the most labor-intensive portion of the process” and requires the person mapping the future architecture to have an understanding of current cloud technology.

“If I was the CIO, I’d set up a team of data center managers, facilities managers, network managers, and vendors” who supply them to get to the right cloud architecture, said Eckhaus. That 14.9% figure is going to rise. “I believe the majority of our members will be involved in the cloud 3-5 years from now,” he said.

AFCOM sponsors two events a year for the 4,500 data center managers who make up the organization. The upcoming show is the 30th anniversary of AFCOM at Data Center World on Oct. 3-6 at the Mirage Hotel and Convention Center in Las Vegas.

Agenda
•Overview: Disaster Recovery
•Getting Started: General Advice
• Business & Technology Considerations
•Deployment
• Configurations & what to buy
•Conclusions & Recommendations

Read the transcript

• “Getting Started with Cloud Computing”  by Alan Joch
• “Higher Altitudes for Cloud Computing” by Eric Sherman
• “Securing The Cloud”  by  George V. Hulme

Read the articles